BitCoin, a digital, virtual currency system, was the platform for some of Kaminsky’s new research. BitCoin is a payment system that charges a low cost per transaction. Each transaction is digitally signed and broadcast, supposedly anonymously, over a peer-to-peer network. Kaminsky announced a new tool called BlitCoin that unmasks one or both ends of a BitCoin transaction.

Anybody know anything about this supposed tool to unmask bitcoin users? Google search for "blitcoin"+kaminsty just returns two links to the article quoted above:

Consensus on the mailing list seems to be that this guy built a graph analysis tool, using some well known properties to associate addresses.

If that's the case it's kind of far-fetched to call it a security vulnerability. But until someone that was there reveals more, it's only guessing...

Bitcoin Core developer [PGP]Warning: For most, coin loss is a larger risk than coin theft. A disk can die any time. Regularly back up your wallet through File → Backup Wallet to an external storage or the (encrypted!) cloud. Use a separate offline wallet for storing larger amounts.

I hope he releases this tool, cause I'd like to use it to find out as much details as possible about a bitcoin theft I was the victim of in June. I'd be surprised if it really works to be honest, but you never know.

Connect to every node in the cloud, discoverable via sweeping/IRC/get_peers messages. The first IP to consistently relay transactions for a given identity, is the given identity.

Of course the entire BitCoin cloud doesn't allow inbound connections (although you can do rather evil stuff with UPNP to force that open too). But this isn't a problem -- there's only about 3000 to 8000 IPs that are BitCoin nodes that accept inbound connections. Since everyone else depends on them, you just need to create your own mass cluster of IPs that are a decent chunk of the P2P network. Nodes on average have seven outbound connections, so it should take only a few hundred unique to be one of the first-hop peers even for the outbound-only set.

Now that I think about it, it might even be possible to do this from a single IP, with lots of ports. I remember seeing some code in there to try to distribute peers across Class B's though so this can be interesting bug #9 that BitCoin manages to smush.

(As a note, I have a tremendous amount of respect for BitCoin; I count it in the top five most interesting security projects of the decade. Entire classes of bugs are missing. But it's just not an anonymous solution, and the devs will say as much.)

Connect to every node in the cloud, discoverable via sweeping/IRC/get_peers messages. The first IP to consistently relay transactions for a given identity, is the given identity.

Of course the entire BitCoin cloud doesn't allow inbound connections (although you can do rather evil stuff with UPNP to force that open too). But this isn't a problem -- there's only about 3000 to 8000 IPs that are BitCoin nodes that accept inbound connections. Since everyone else depends on them, you just need to create your own mass cluster of IPs that are a decent chunk of the P2P network. Nodes on average have seven outbound connections, so it should take only a few hundred unique to be one of the first-hop peers even for the outbound-only set.

Now that I think about it, it might even be possible to do this from a single IP, with lots of ports. I remember seeing some code in there to try to distribute peers across Class B's though so this can be interesting bug #9 that BitCoin manages to smush.

(As a note, I have a tremendous amount of respect for BitCoin; I count it in the top five most interesting security projects of the decade. Entire classes of bugs are missing. But it's just not an anonymous solution, and the devs will say as much.)

So "deanonymize" means "associate transaction with IP address"? If so, that does seem like it would work. I recall seeing somewhere that bitcoin can run over TOR, but I doubt very many people do that. I guess if you are using silk road you should!

Unfortunately, it won't help anybody investigating past crimes, since you would have to be monitoring the network in this way when the crime happened.

Also, is Dan claiming he put text in the genesis block? Maybe I don't understand correctly, or maybe it was a joke . . .

Also, is Dan claiming he put text in the genesis block? Maybe I don't understand correctly, or maybe it was a joke . . .

Not the genesis block, a more recent block. He embedded some text in the blockchain, an ASCII-art tribute to a hacker who recently committed suicide, as well as Ben Bernanke, the terrorist who controls the world economy.

Also, is Dan claiming he put text in the genesis block? Maybe I don't understand correctly, or maybe it was a joke . . .

Not the genesis block, a more recent block. He embedded some text in the blockchain, an ASCII-art tribute to a hacker who recently committed suicide, as well as Ben Bernanke, the terrorist who controls the world economy.

Somebody paste it please. I'm lazy/busy/not running linux, but I want to see the tribute to the hacker who became "an hero".

Also, is Dan claiming he put text in the genesis block? Maybe I don't understand correctly, or maybe it was a joke . . .

Not the genesis block, a more recent block. He embedded some text in the blockchain, an ASCII-art tribute to a hacker who recently committed suicide, as well as Ben Bernanke, the terrorist who controls the world economy.

Somebody paste it please. I'm lazy/busy/not running linux, but I want to see the tribute to the hacker who became "an hero".

"What type of transactions are we talking about here? Would you need to actually spend BTC to reveal information? "

Loose transactions that involve sending money, can expose the IP address of the sender. The transaction has to enter the relay network somehow, and the first sender is the source.

"I was kind of hoping for something a little more interesting, giving his penchant for breaking shit - but this is neat too."

No need to overcomplicate things. Although, looking at the source, each peer node that is selected from the outbound lists has to be on a unique /16 network. Getting large numbers of nodes with inbound connectivity and unique x.y.0.0 addresses is actually a bit of a task. I have a little more interesting plan for how to achieve that inexpensively.

What type of transactions are we talking about here? Would you need to actually spend BTC to reveal information?

Can anyone who is familiar with the network source give us a breakdown of how this attack would work?

I'm guessing you just float a buttload of incoming-capable P2P hosts on the Bitcoin network*, then wait for your mark to spend some coins. You might be able to speed this process up by spending some to them, so they think "shit, free money" and spend it elsewhere, but maybe not and it's certainly not always required if you can know they're going to do a spend at some point.

Then the basic idea is you just watch which peer on the network the transaction comes from first, with that peer being the likely IP address of the originator. It involves a lot of peers (since you need a way to guarantee that you are connected to pretty much every peer on the network), some luck, and you have to hope that they're not using a proxy/open WLAN/whatever, and that getting their IP is useful in actually identifying them.

It's not really a useful real-world attack for the most part, other than demonstrating that "anonymous" is absolutely the wrong word to describe Bitcoin... but if you've done your reading then you know that the only people who use the word "anonymous" to describe Bitcoin don't know their arse from their elbow anyway.

Edit: Yes, the slides indeed say this and he even suggests it's not as many as I figured you'd need given that the average outbound-only client connects to about 7~8 peers.